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Redundant Electronic Circuit Provides Fail-Safe Control 
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The problem: 

To design a reliable hydraulic valve controller 
that prevents closure of a valve when control circuits 
fail, and maintains valve control to a close tolerance 
for the more common modes of controller failure. 

The solution: 

A circuit using dual control amplifiers and dual 
position demand potentiometers powered from sepa- 


rate sources. The circuit configuration enables the out- 
put of one amplifier to override a failure in the other 
amplifier. 

How it’s done: 

The circuit shown in the figure operates in conjunc- 
tion with a valve which opens upon loss of a signal, 
thus preventing the valve from closing when the 
control system fails. In operation, the resistor and 
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diode combination, CR3/R17 and CR6/R18, provides 
two amplifiers with the capability of more “negative” 
output current than “positive” output current, regard- 
less of the failure (negative and positive indicating 
current flow direction). 

Referring to the amplifier gains in the figure, the 
controller will maintain the valve position within 
± 3% of the demanded value for the following failures: 
(+) or (-) 24 or 15 V dc open or short; position 
demand from R3 and R4 open or short; and shorting 
of the (+) output transistor in the DL-21 or DL-1 
amplifier. 

The valve position error caused by one of the above 
failures is inversely proportional to the gain of the 
two control amplifiers. Therefore, if the valve gain is 
low, the gain of the control amplifiers may be made 
high, reducing the error. Conversely, a failed-closed 
valve system can be made by reversing any of the fol- 
lowing: the excitation voltage connections to the 

valve position potentiometer; the leads to the servo 
valves; the excitation voltage to the two-position 
demand potentiometers; and diodes CR3 and CR6. 


Notes: 

1. Although the circuit accommodates the “worst” 
case (permanent short or open), it will also function 
in lesser failures such as partial opens or shorts. 

2. Shorting of amplifier output to ground is a pos- 
sibility (which will also be accommodated). How- 
ever, this is not a “worst” case since in most cir- 
cuits the “common” and “ground” are so connected 
that very little voltage potential can exist between 
them. 

3. Inquiries may be directed to: 

Technology Utilization Officer 
AEC-NASA Space Nuclear Propulsion Office 
U.S. Atomic Energy Commission 
Washington, D.C. 20545 
Reference: B70- 10565 

Patent status: 

No patent action is contemplated by AEC or NASA. 

Source: J. W. Archer of 

Aerojet-General Corp. 
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Space Nuclear Propulsion Office 
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